e107 contains a flaw that may allow an attacker to upload and execute arbitrary php code. The issue is triggered when a would be attacker uploads a crafted php file with the extension ".php.filetypesphp" as their avatar or photograph image and then access the url for their image in order to invoke the php code.
Classification
Location:
Remote / Network Access
Attack Type:
Input Manipulation
Impact:
Loss of Integrity
Solution:
Upgrade
Exploit:
Exploit Unknown
Disclosure:
Vendor Verified,
Vendor Verified,
Coordinated Disclosure
OSVDB:
Web Related
Solution
Upgrade to version 0.7.20 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.
